done with 1st phase of login API